Intel Security CenterINTEL:INTEL-SA-006172022.1 IPU - Intel® Processor Advisory
Summary:
A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability.****
Vulnerability Details:
CVEID: CVE-2022-21151
Description: Processor optimization removal or modification of security-critical code for some Intel® Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Base Score: 5.3 Medium
CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N****
Affected Products:
Product Collection
|
Vertical Segment
|
CPU ID
|
Platform ID
—|—|—|—
10th Generation Intel® Core™ Processor Family
|
Mobile
|
706E5
|
80
Intel® Pentium® Processor Silver Series
Intel® Celeron® Processor J Series
Intel® Celeron® Processor N Series
|
Desktop
Mobile
|
706A1
|
01
8th Generation Intel® Core™ Processor Family
|
Desktop
|
906EB
|
02
8th Generation Intel® Core™ Processors
|
Mobile
|
806EC
|
94
10th Generation Intel® Core™ Processor Family
|
Desktop
Mobile
|
A0653
A0655
AO661
806EC
|
22
02
80
94
6th Generation Intel® Core™ Processor Family
|
Desktop
Mobile
|
506E3
406E3
|
36
C0
7th Generation Intel® Core™ Processor Family
|
Desktop
Mobile
|
906E9
806E9
|
2A
C0
9th Generation Intel® Core Processor Family
| Desktop |
A0671
|
02
3rd Generation Intel® Xeon® Scalable Processors
|
Server
|
606AX
|
0x87
Recommendations:
Intel recommends that users of affected Intel® Processors update to the latest version firmware provided by the system manufacturer that addresses these issues.
Intel has released microcode updates for the affected Intel® Processors that are currently supported on the public github repository. Please see details below on access to the microcode:
GitHub*: Public Github: <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files>__
This CVE requires a Microcode Security Version Number (SVN) update. To address this issue, an Intel SGX TCB Recovery is planned. Details can be found here.
Refer to Intel® SGX Attestation Technical Details for more information on the SGX TCB recovery process.
Further TCB Recovery Guidance for developers is available.
Acknowledgements:
This issue was found internally by Intel employees. Intel would like to thank Alysa Milburn, Jason Brandt, Avishai Redelman, Nir Lavi for reporting this issue.
Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.
Related
